Countries Tracked
Cyber Attacks
An independent research initiative measuring how armed conflict and cyber threats combine to create structural pressure on healthcare systems worldwide.
Explore country-level data on conflict, displacement, healthcare capacity, and demographic vulnerability across the countries assessed by MSI.
Select a country to explore its data.
Beyond physical attacks in conflict zones, healthcare systems face a growing wave of digital threats.
Encrypts patient records and locks clinical systems until paid — often forcing hospitals to divert ambulances and delay care.
Floods hospital networks and patient portals with traffic, knocking scheduling and telehealth systems offline when care teams need them most.
Targets connected medical devices and building-control systems — from HVAC and power to networked diagnostic equipment.
Exposes patient histories, insurance details, and personal identifiers — among the most valuable, long-lasting data on the black market.
Explore how reported healthcare data breaches are distributed across the United States through MSI’s cybersecurity research interface.
HIPAA-reportable healthcare breach filings · state-level dataset
Loading state-level filing data…
A preview of the state-level filing counts explored in the full MSI Cyber dashboard.
Breach data: Patient Protect — patient-protect.com/breachdash · CC BY 4.0
MSI Cyber turns Patient Protect breach-dashboard data into an interactive research interface for exploring state-level patterns and potential data-quality concerns.
We track, analyze, and document attacks on healthcare systems to inform research and protection strategies.
Comparative research combining conflict, displacement, healthcare capacity, and demographic data to examine pressures on healthcare systems.
We analyze patterns of conflict, displacement, and digital threats from real crisis zones to understand how healthcare systems come under pressure.
Our research points out vulnerabilities in healthcare systems and highlights strategies to protect healthcare access during crises.
How incidents are verified, standardized, and included in the index.
The Healthcare System Stress Flag, or HSSF, is the Medical Security Index’s primary analytical framework for identifying countries where multiple structural pressures may place healthcare systems under elevated stress.
| Measure | Version 1.0 |
|---|---|
| Countries assessed | 50 |
| Component indicators | 6 |
| Indicator weighting | Equal |
| Underlying score | 0–6 |
| Classifications | Low, Moderate, High, Extreme (1–4) |
| Framework type | Rule-based screening indicator |
Background on the legal, humanitarian, and structural context behind the index.
Under international humanitarian law, including the Geneva Conventions, healthcare systems are supposed to be granted protection during armed conflict. Hospitals, medical personnel, and medical units must not be targeted under any circumstances.
Despite these legal protections, attacks on healthcare continue to occur as tensions rise globally and new conflicts erupt. The Medical Security Index was created to better understand these risks by analyzing conflict intensity, healthcare system capacity, displacement pressures, and demographic vulnerability.
By combining conflict data, healthcare system capacity indicators, and displacement pressures, the index identifies environments where medical systems may face elevated structural stress — giving researchers and policymakers insight into how conflict and cyber threats affect global healthcare infrastructure.
Healthcare systems store sensitive patient information and rely heavily on digital infrastructure, making them attractive targets for cyber criminals. Attacks can disrupt hospital operations, compromise patient safety, and expose confidential medical records — challenges compounded by limited resources and outdated systems.
Find answers to commonly asked questions about our research.
An independent research initiative that tracks and analyzes threats to healthcare systems worldwide, using verified data to understand how conflict and cyber threats disrupt healthcare delivery.
Attacks can damage facilities, interrupt surgeries and routine treatments, displace healthcare workers, disrupt supply chains, and damage infrastructure such as electricity and water systems.
Verified and publicly available sources, including international organizations, healthcare reporting networks, and documented case studies, cross-referenced and standardized before inclusion.
By highlighting structural risks in conflict and crisis environments, the index provides insights that support research, policy discussions, and efforts to strengthen healthcare protections.
Yes. Our interactive map and research findings are publicly accessible to researchers, policymakers, healthcare professionals, and the broader public.
It combines conflict intensity, healthcare system capacity, internal displacement, and demographic vulnerability — few existing datasets integrate all of these factors together.
Volume 1 · Issue 1 · August 2026 — the full inaugural issue, page by page.
Patient Protect breach dashboard · CC BY 4.0
Tracking HIPAA-reportable data breaches across all 50 U.S. states. Identifying patterns, discrepancies, and systemic vulnerabilities in healthcare cybersecurity.
01 / Cyber attack vectors
Beyond physical attacks in conflict zones, healthcare systems face a growing wave of digital threats.
Encrypts patient records and locks clinical systems until paid — often forcing hospitals to divert ambulances and delay care.
Floods hospital networks and patient portals with traffic, knocking scheduling and telehealth systems offline when care teams need them most.
Targets connected medical devices and building-control systems — from HVAC and power to networked diagnostic equipment.
Exposes patient histories, insurance details, and personal identifiers — among the most valuable, long-lasting data on the black market.
Attackers infiltrate through vendors, billing partners, and cloud services — a single compromised vendor can affect dozens of healthcare organizations.
Employees or contractors access records beyond their scope — sometimes for identity theft, sometimes through negligence.
02 / Interactive breach map
Choose a state to explore filing counts, distinct organizations, source-event groups, risk classification, and MSI research flags.
Select a state on the U.S. map to inspect its reported breach data
State outlines: us-atlas by Michael Bostock (ISC license). Color indicates filing-volume risk; select any state for details.
Select a state on the map or in the ranking table for detailed breach data.
03 / Analytics dashboard
Deep-dive into filing patterns, discrepancies, and organizational distribution across states.
HIPAA-reportable healthcare data breaches · filing count
Gap between reported filings and distinct source event groups
Bubble size = filing/group gap; deviation from diagonal = data quality concern
04 / Complete rankings
Search the complete state-level breach filing dataset. Select a row to load that state’s detail panel above.
| Flag |
|---|
05 / Research insights
MSI-identified patterns from cross-state analysis of HIPAA breach filings.
California has the most filings; Texas has the most distinct exact organization names, at 125.
Respectively 135/116, 62/55, and 43/37 filings versus supplied groups. These gaps remain unresolved.
The Change Healthcare filing reports 192.7 million affected persons—99.5% of Minnesota’s raw sum. This does not imply those individuals reside there.
The largest filings report 15M, 9.54M, 5.56M, and 4.3M affected persons, respectively.
These states are candidates for investigating whether a few large filings dominate the raw affected-person sums.
A supplied DentaQuest group spans Wisconsin and Massachusetts with conflicting dates and affected counts.
06 / Methodology
HIPAA-reportable breach filings sourced from Patient Protect, covering all 50 U.S. states.
Filings are grouped by source event to identify when multiple filings relate to a single breach incident.
Distinct organization names are resolved to identify unique entities affected by breaches.
Critical (80+), High (40+), Elevated (20+), Moderate (10+), or Low (<10) based on filing volume.
States with notable discrepancies, concentration anomalies, or cross-state grouping issues receive MSI analysis flags.
Filing/group discrepancies (for example, California: 135 filings versus 116 groups) indicate cases where the relationship between individual filings and source breach events needs further investigation. Gaps may reflect multi-state incidents, amended filings, or data-entry variations. The Change Healthcare filing in Minnesota (192.7M affected persons) represents 99.5% of Minnesota’s raw sum, but does not imply those individuals reside there; geographic attribution requires additional analysis.
Data source: Patient Protect — patient-protect.com/breachdash. Patient Protect’s breach dashboard data is licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) license. The headline cards are a captured dashboard snapshot, and hosted counters can change between visits. State-level totals may not add up to the overall cards because a source event or organization can appear in multiple states. Charts and rankings use the state-level values listed in the table. This dashboard is for research and analysis and is not clinical guidance or a binding resource-allocation recommendation.
Preview the MSI's new app covering the opioid crisis in Alameda County. Alameda Lifeline - Making resources accessible for Alameda Youth amidst the opioid crisis
Submitted to the 2026 Congressional App Challenge in California’s 10th Congressional District, under Congressman Mark DeSaulnier.
The full Healthcare System Stress Flag (HSSF) Version 1.0 framework — how it's built, what it measures, and where it falls short.
The Healthcare System Stress Flag, or HSSF, is the Medical Security Index’s primary analytical framework for identifying countries where multiple structural pressures may place healthcare systems under elevated stress.
While many existing global indices measure conflict or healthcare capacity independently, the HSSF was designed to capture the interaction between conflict exposure and healthcare system resilience.
The framework combines country-level data on armed conflict, internal displacement, healthcare capacity, access to essential services, and population structure.
HSSF is designed as a comparative screening tool. It is not a clinical measure, predictive model, measure of healthcare quality, or forecast of health-system collapse.
Healthcare systems may face increasing structural pressure when several forms of vulnerability occur at the same time. HSSF Version 1.0 examines six dimensions:
The framework does not assume that any one indicator can explain healthcare-system stress on its own. Instead, it identifies countries where several measurable stressors coexist.
A High or Extreme classification does not mean that a healthcare system has collapsed. A Low classification does not mean that a country is free from healthcare, humanitarian, or security challenges.
HSSF is intended to support:
The Version 1.0 MSI dataset includes 50 countries selected through purposive sampling based on:
The sample is intended for exploratory comparative analysis. It is not representative of every country globally and should not be interpreted as a complete global ranking. Future versions may adopt a more systematic country-inclusion rule as MSI expands its coverage and strengthens its data-completeness requirements.
The HSSF calculation follows four steps.
Indicators that depend on national population size are converted into per-capita rates or percentages. This allows countries of different population sizes to be compared more consistently.
Each indicator is assessed against a fixed Version 1.0 operational threshold.
A country receives one point for every threshold it meets. All six indicators are equally weighted.
The points are added to produce a total score from 0 to 6. That score is then converted into one of four HSSF classifications:
Conflict intensity
Conflict deaths per 100,000 measures the number of fatalities associated with state-based armed conflict relative to a country’s population. Population adjustment makes it possible to compare conflict intensity across countries with substantially different population sizes.
High levels of conflict mortality may indicate an environment in which healthcare systems face greater disruption. Conflict can affect:
This indicator does not directly count attacks on healthcare facilities or personnel. It measures the broader intensity of the state-based conflict environment.
State-based conflict fatalities: Uppsala Conflict Data Program
Population denominator: World Health Organization country data
State-based conflict fatalities: 2024
Population denominator: 2023
Conflict deaths per 100,000 = State-based conflict fatalities / Population × 100,000
5 or more conflict deaths per 100,000 people
Threshold met: 1 point
Threshold not met: 0 points
The threshold is intended to identify countries experiencing comparatively elevated population-adjusted conflict intensity. It is an operational Version 1.0 decision and has not yet been statistically optimized or externally calibrated.
UCDP state-based conflict data does not represent every form of violence or insecurity. It may not fully capture:
A national rate may also obscure severe conflict concentrated within particular regions.
Conflict persistence
Years of sustained conflict measures the number of years between 2015 and 2024 in which a country met MSI’s active-conflict criterion. A qualifying year is one in which the country recorded at least 25 state-based conflict fatalities. Qualifying years do not need to be consecutive.
Conflict can weaken healthcare systems gradually as well as through sudden shocks. Persistent conflict may contribute to:
This indicator captures duration across time rather than the intensity of one year.
Uppsala Conflict Data Program
2015–2024
For each year in the ten-year period:
The qualifying years are then added together.
7 or more qualifying years between 2015 and 2024
Threshold met: 1 point
Threshold not met: 0 points
Seven qualifying years indicates sustained exposure across most of the ten-year reference period. The threshold is intended to distinguish persistent conflict environments from countries experiencing shorter or more isolated periods of state-based conflict.
The indicator does not distinguish between:
Displacement pressure
Conflict-related IDPs per 100,000 measures the stock of people internally displaced by conflict and violence relative to the national population. Internally displaced people remain within their country’s borders but may lose access to housing, employment, medication, sanitation, transportation, and established healthcare networks.
Large-scale displacement can simultaneously increase demand for healthcare and weaken continuity of access. Displacement may:
Conflict-related displacement stock: Internal Displacement Monitoring Centre (IDMC)
Population denominator: World Health Organization country data
Conflict-related displacement stock: 2024
Population denominator: 2023
IDPs per 100,000 = Conflict-related IDPs / Population × 100,000
5,000 or more IDPs per 100,000 people. This is equivalent to approximately 5% of the national population.
Threshold met: 1 point
Threshold not met: 0 points
The threshold is intended to identify countries where internal displacement represents a substantial share of the national population and may place meaningful pressure on healthcare access and service demand.
IDP stock is a point-in-time measure. It does not fully capture:
National rates may conceal much more severe regional pressures.
Healthcare capacity
Hospital beds per 1,000 people measures reported inpatient-bed capacity relative to population size.
Hospital-bed density provides a broad indication of the physical capacity available for inpatient treatment. Limited capacity may become more consequential when healthcare systems face:
World Bank World Development Indicators
Latest available country-year used in the Version 1.0 database. The exact reference year may differ by country.
Fewer than 1 hospital bed per 1,000 people
Threshold met: 1 point
Threshold not met: 0 points
The threshold identifies countries with especially limited reported inpatient capacity. It is an operational Version 1.0 benchmark and should not be interpreted as a universal standard for healthcare-system adequacy.
Hospital-bed density does not measure:
A country may have relatively high reported bed density and still experience serious healthcare-system stress.
Access to essential healthcare services
Skilled birth attendance measures the percentage of births attended by personnel trained to provide essential childbirth care.
The indicator provides a broad proxy for access to essential health services and functioning maternal-health infrastructure. Lower coverage may reflect challenges involving:
Maternal-health services may be particularly vulnerable to conflict, displacement, and infrastructure disruption.
World Bank World Development Indicators
Latest available country-year used in the Version 1.0 dataset. The exact reference year may vary by country.
Below 70%
Threshold met: 1 point
Threshold not met: 0 points
The threshold is intended to identify countries where a substantial share of births may occur without skilled attendance. It is an operational Version 1.0 rule and is not presented as a universal international cut-point.
Skilled birth attendance represents one dimension of healthcare access. It does not fully measure:
Demographic vulnerability
This indicator measures the percentage of a country’s population below age 15.
A younger population structure may create greater demand for:
When combined with conflict, displacement, or limited capacity, this demand may contribute to structural pressure on healthcare systems.
World Bank World Development Indicators
Latest available country-year used in the Version 1.0 dataset. The exact reference year may vary by country.
40% or more of the population under age 15
Threshold met: 1 point
Threshold not met: 0 points
The threshold identifies countries with particularly young population structures and potentially elevated demand for maternal, pediatric, preventive, and primary healthcare services.
A young population does not itself indicate healthcare-system weakness. Its relevance within HSSF comes from its interaction with the other structural pressures measured by the framework.
HSSF does not use statistical standardization.
After these conversions, indicators are evaluated against fixed thresholds. The term normalization refers to per-capita or percentage conversion, not statistical normalization.
MSI does not:
Only genuine zero values reported by the source dataset are recorded as zero.
Each indicator contributes one point. No indicator receives additional weight.
The total HSSF score is:
The minimum possible score is 0. The maximum possible score is 6.
Equal weighting was selected to:
Equal weighting does not imply that the six indicators have equal real-world or causal importance.
| Underlying HSSF score | Classification |
|---|---|
| 0–1 | Low |
| 2–3 | Moderate |
| 4–5 | High |
| 6 | Extreme |
The classification scale is ordinal: Low → Moderate → High → Extreme
Some figures and maps may encode the four classifications numerically:
| Display code | Classification |
|---|---|
| 1 | Low |
| 2 | Moderate |
| 3 | High |
| 4 | Extreme |
The 1–4 display code is used only for visualization. It is not the underlying HSSF score, which ranges from 0 to 6.
HSSF Version 1.0 was developed before MSI adopted a formal complete-data eligibility policy. Some Version 1.0 classifications were retained despite missing values in the primary dataset. These classifications should be interpreted as provisional and will be reassessed in a future methodological release.
Beginning with the next HSSF version: A country must have values for all six component indicators to receive a classification.
Countries with one or more unresolved missing indicators will be labeled: Insufficient Data
Insufficient Data does not indicate low healthcare-system stress or low humanitarian need. It means that MSI cannot calculate the HSSF consistently using all six required indicators.
When a primary standardized dataset does not provide a required observation, MSI may consider an approved alternate source.
Potential alternate sources include:
An alternate value may only be used when:
| Data status | Meaning |
|---|---|
| Standardised | All six indicators use MSI’s primary datasets |
| Supplemented | At least one indicator uses an approved alternate source |
| Insufficient Data | One or more required indicators remain unavailable |
Countries using alternate-source data should be identified in MSI’s technical records.
Alternate values may differ from primary standardized datasets in:
HSSF is intended to help answer: Where do multiple measurable structural pressures coexist?
It is not intended to answer:
HSSF classifications should be interpreted alongside:
HSSF Version 1.0 has several important limitations.
The six thresholds are research-team-defined and have not yet been statistically validated or externally calibrated.
All indicators contribute one point, although their real-world effects may differ across countries and settings.
Some health indicators use the latest available observation, meaning values may refer to different years across countries.
National averages may conceal major differences between regions, cities, displacement sites, and conflict-affected communities.
UCDP state-based conflict data does not capture every form of violence, insecurity, or humanitarian disruption.
IDP stock does not fully represent displacement flows, repeated displacement, duration, returns, or living conditions.
Hospital-bed density does not measure functionality, staffing, supplies, quality, occupancy, or geographic access.
Skilled birth attendance represents one part of healthcare access and does not measure the entire health system.
A young population is not itself evidence of healthcare-system weakness.
HSSF Version 1.0 does not directly include a coded indicator for attacks on healthcare facilities, personnel, or transports.
Healthcare cybersecurity is an expanding MSI research area but is not included in the HSSF Version 1.0 calculation.
Data gaps may limit classification, particularly in countries experiencing severe conflict or institutional disruption.